4 ms·

Yeah, it's left me a little disappointed in Arch in particular that they didn't follow the lead of Debian and Fedora and revert to a much older version, instead

by Macha 3y ago

Yeah, it's left me a little disappointed in Arch in particular that they didn't follow the lead of Debian and Fedora and revert to a much older version, instead just building 5.6.1 from the git repo and basically defended it as "the hacked build script checked for dpkg/rpm anyway".

antoinealb 3y ago
Arch Linux is not vulnerable to this specific attack, which requires sshd to be linked to liblzma. This link is provided by out-of-sshd patches, that Arch does not apply to their build.
- skywhopper 3y ago
  But as this article points out, liblzma is used in other crucial processes, and is generally trusted, often probably being run as root. The known bad actor contributed lots of code to xz that isn’t involved in the SSH backdoor. To assume it’s all innocuous would be truly foolish.
- cowsandmilk 3y ago
  The point here is there is uncertainty in all commits by Jia Tan, Arch’s focus is on this specific hack, but are there other vulnerabilities in the hundreds of commits to the git repo from the same author?
diggan 3y ago
Is this what you're referring to? > Regarding sshd authentication bypass/code execution > Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command: > However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist. https://archlinux.org/news/the-xz-package-has-been-backdoored/ https://archlinux.org/news/the-xz-package-has-been-backdoore... I'm not finding anything from Arch mentioning dpkg/rpm, the linked article above is the latest article about the xz compromise from the Arch homepage.
- Macha 3y ago
  - https://bbs.archlinux.org/viewtopic.php?pid=2160841#p2160841 https://bbs.archlinux.org/viewtopic.php?pid=2160841#p2160841 - https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2 https://gitlab.archlinux.org/archlinux/packaging/packages/xz... - There were some comments in the middle of the giant openwall mailing list thread I can't find now because they're in the middle of 30,000 replies
k3vinw 3y ago
Wow. So for the xz package it looks like they changed the upstream to this (edit: the original maintainer’s personal repo, Lasse Collins) git repo that still contains Jia Tan’s commits: https://git.tukaani.org/?p=xz.git https://git.tukaani.org/?p=xz.git tl;dr they re-enabled the sandboxing previously disabled by Jia Tan.
TheTxT 3y ago
Arch tries to always be as current as possible, for better or for worse. So this definitely makes sense for arch

by Macha 3y ago

antoinealb 3y ago

Arch Linux is not vulnerable to this specific attack, which requires sshd to be linked to liblzma. This link is provided by out-of-sshd patches, that Arch does not apply to their build.

skywhopper 3y ago
But as this article points out, liblzma is used in other crucial processes, and is generally trusted, often probably being run as root. The known bad actor contributed lots of code to xz that isn’t involved in the SSH backdoor. To assume it’s all innocuous would be truly foolish.
cowsandmilk 3y ago
The point here is there is uncertainty in all commits by Jia Tan, Arch’s focus is on this specific hack, but are there other vulnerabilities in the hundreds of commits to the git repo from the same author?

diggan 3y ago

Is this what you're referring to? > Regarding sshd authentication bypass/code execution > Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command: > However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist. https://archlinux.org/news/the-xz-package-has-been-backdoored/ https://archlinux.org/news/the-xz-package-has-been-backdoore... I'm not finding anything from Arch mentioning dpkg/rpm, the linked article above is the latest article about the xz compromise from the Arch homepage.

Macha 3y ago
- https://bbs.archlinux.org/viewtopic.php?pid=2160841#p2160841 https://bbs.archlinux.org/viewtopic.php?pid=2160841#p2160841 - https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2 https://gitlab.archlinux.org/archlinux/packaging/packages/xz... - There were some comments in the middle of the giant openwall mailing list thread I can't find now because they're in the middle of 30,000 replies

k3vinw 3y ago

Wow. So for the xz package it looks like they changed the upstream to this (edit: the original maintainer’s personal repo, Lasse Collins) git repo that still contains Jia Tan’s commits: https://git.tukaani.org/?p=xz.git https://git.tukaani.org/?p=xz.git tl;dr they re-enabled the sandboxing previously disabled by Jia Tan.

TheTxT 3y ago

Arch tries to always be as current as possible, for better or for worse. So this definitely makes sense for arch